hacks4sale.com - Trojan dropper

[JesusSpork]

I downloaded the demo software at www.hacks4sale.com b/c I was going to try & crack it. While installing it dropped ods.exe, stm.exe, msn.exe, iexplorer.exe, and ICSharpCode.SharpZipLib.dll into the Internet Explorer directory and had the attributes of being System files and were hidden.

Also, the demo doesn't do anything, I opened it in Reflector after unpacking, here's a bit of it:

box.Text = (box.Text & "Activated" & ChrW(13) & ChrW(10))
	Thread.Sleep(2000)
	box = Me.TextBox7
	box.Text = (box.Text & "Connected to database!" & ChrW(13) & ChrW(10))
	box = Me.TextBox7
	box.Text = (box.Text & "Database dropped connection, retry in 2#" & ChrW(13) & ChrW(10))
	Thread.Sleep(200)
	box = Me.TextBox7
	box.Text = (box.Text & "Connected to database!" & ChrW(13)

The original is protected with .net Reactor so I included the unpacked copy. Password is "tuts4you", even though there isn't any malicious code in these two .exe's

Edit: It also adds taksman.exe to the Startup folder.

H4S_Advanced_Password_Retriever.rar

Edited June 16, 2009 by JesusSpork

[SAM777]

it's not letting me donload the attched file...plzzz help!!

[LISA454]

doesnt work

[elhosiny]

hi....

I try this application but it dosn't work with me

Please try to tell me how 2 solve this problem

Thanx alot